make sure DSA signing exponentiations really are constant-time

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 0be0a88e1b7c087c6398974e6053060a2cb65b93..3b68628fb206a440b9d7555ce14bec1bc493cf17 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,8 +2,17 @@
  OpenSSL CHANGES
  _______________
 
+ Changes between 0.9.8 and 0.9.9  [xx XXX xxxx]
+
+  *) 
+
  Changes between 0.9.7h and 0.9.8  [xx XXX xxxx]
 
+  *) Add attribute functions to EVP_PKEY structure. Modify
+     PKCS12_create() to recognize a CSP name attribute and
+     use it. Make -CSP option work again in pkcs12 utility.
+     [Steve Henson]
+
   *) Add new functionality to the bn blinding code:
      - automatic re-creation of the BN_BLINDING parameters after
        a fixed number of uses (currently 32)
@@ -794,6 +803,28 @@
 
  Changes between 0.9.7g and 0.9.7h  [XX xxx XXXX]
 
+  *) For DSA signing, unless DSA_FLAG_NO_EXP_CONSTTIME is set, perform
+     the exponentiation using a fixed-length exponent.  (Otherwise,
+     the information leaked through timing could expose the secret key
+     after many signatures; cf. Bleichenbacher's attack on DSA with
+     biased k.)
+     [Bodo Moeller]
+
+  *) Make a new fixed-window mod_exp implementation the default for
+     RSA, DSA, and DH private-key operations so that the sequence of
+     squares and multiplies and the memory access pattern are
+     independent of the particular secret key.  This will mitigate
+     cache-timing and potential related attacks.
+
+     BN_mod_exp_mont_consttime() is the new exponentiation implementation,
+     and this is automatically used by BN_mod_exp_mont() if the new flag
+     BN_FLG_EXP_CONSTTIME is set for the exponent.  RSA, DSA, and DH
+     will use this BN flag for private exponents unless the flag
+     RSA_FLAG_NO_EXP_CONSTTIME, DSA_FLAG_NO_EXP_CONSTTIME, or
+     DH_FLAG_NO_EXP_CONSTTIME, respectively, is set.
+
+     [Matthew D Wood (Intel Corp), with some changes by Bodo Moeller]
+
   *) Change the client implementation for SSLv23_method() and
      SSLv23_client_method() so that is uses the SSL 3.0/TLS 1.0
      Client Hello message format if the SSL_OP_NO_SSLv2 option is set.